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PROGRAM ALARMS IN POWERED DESCENT - APOLLO 11 
DISCUSSION OF ALARM CODES OBSERVED AND THEIR MEANING • 

The -IOC issued several Program Alarms subsequent to PDI. Examination 
of MSFN LGC digital downlist data presently available.(July 22) indicates 
that there were 4 1202 alarms and 1 1201 alarm - See Table I for a tabulation 
of events during the powered portion of the landing as extracted from MSFN 
Tabs. These two classes of Alarm Codes are stored when the IGC*s internal V 
^Job control routine, the EXECUTIVE, receives a request to establish another y 
Job under its control when it is.already controlling all the Jobs it has 
capacity for. Any Job activity in the IGC requires a small unshared set of 
er.’asable memory locations, called a core set. More complicated Jobs such 
as navigation or guidance computations, require a larger additional group of 
memory locations for Interpretive Mode computations. These memory sets are 
called Vector^Accumulators or VAC areas. The EXECUTIVE has available for 
assignment to Jobs 8 core sets and 5 VAC areas • Any request to establish a 
Job after the 8 core sets are in use leads to the 1202 Alarm Code condition 
while a request to establish a Job requiring a VAC area after the 5 are 
assigned (availability of a core set is first checked) leads to AC1201. 

These Alarm Codes tte n indicate overflows of the Job scheduling 
capacity of the IGC*s internal Job control routine. When this condition 
is detected by the EXECUTIVE routine it transfers program control to an 
ALARM & ABORT routine which stores the appropriate code for display on the 
downlist and for possible display on the DSKY (by V5N9E), lights the PROG 
(Alarm) light on the DSKY, and transfers control to the FRESH START and 
RESTART routines. These are routines that were originally programmed to 
follow the IGC hardware activities resulting from a hardware detected 
restart. When the IGC goes to the RESTART.routines from the ALARM & 

ABORT routines it is said to be doing a Software Restart, however. 


The RESTART routines perform a general reinitialization of the machine 
rather similar to that done by a Fresh Start (V 36 E) and in fact using common 
coding. This includes clearing out the EXECUTIVE*s list of currently scheduled 
Jobs. While a Fresh Start leaves the computer in a basic initial condition 
requiring loading and operator activity to bring up useful activity such as a 
Mission Program, the RESTART routines pass off to another routine which works 
in conjunction with the "restart protection" of the interrupted program (P 63 
and P64 in this case) to automatically put that program back into action at a 
logical poino without loss of significant data such as the state vector and 
the PIPA’s. 

The IGC Flight Programs have been extensively "restart protected" which 
means that added into the mainline program coding are instructions which 
communicate to a service routine, called PHASE TABIE MAINTENANCE, information 
as to the progress of the mainline program*s execution. The MAINTENANCE 
routine^refers the "progress reports" to preplanned fixed coding or can 
accept variable" information as to what activities should be started in case 
of a subsequent restart. Therefore the last sequence in a restart is a check 
of the Phase Tables and the activation of the routines then called for. The 
continued performance of the Primary Guidance Programs past the -points of 
EXECUTIVE overflows was due to their restart protection. 
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There, were also reports that an AC 1203 was experienced. Data 
available does not show any 1203*s. The 1203 Alarm Code is quite similar 
to the 1201 and 1202. It indicates a scheduling overload of"the WAITLIST, 
an LGC service routine that schedules time dependent activities called 
Tasks (as opposed to Jobs). When too many Tasks are attempted to be 
scheduled, a similar sequence to the EXECUTIVE overflow is started/ lead¬ 
ing ultimately to a Software Restart. The point of transfer into the 
ALARMS routine for all three of these Alarm Codes is called mnemonically 
"BAILOUT" so these alarms are somethimes called Bailout Alarms. They are 
equivalent to Software Restarts 

DISCUSSION OF ACTIVITY OBSERVED ON MSFN DATA 
Bt ' 

m mc ip ^3 commanded the Descent Engine OK at approximately 102 

33 04 GET to start PDI. About four and three quarters minutes later the 

LRALT light on the DSKY went out indicating Altitude Data Good from the LR. 
About 20 seconds later at 3^ m 09 s the crew started to request a monitor of 
N 68 (V16n68e) to show the difference between LR altitude and IOC altitude to 
determine if the LGC should start to incorporate this LR data. 12 seconds 
later and in the monitor, the first 1202 occurred. The GUIDO recognized 
that monitor verbs are a significant load on the computer and the Ground 
told the Crew that they would cover, monitoring the altitudes for them. At 
38 43 s the Crew entered V 57 which tells the.IGC to start incorporating LR 

data (if still good). However, at 3& m 49 s the Crew again requested Vl 6 ll 68 . 
This would be normal procedure to determine the effect of incorporating LR 
data. The altitude difference in R3 should decrease. 12 seconds later 
another 1202 came up in the monitor. Note that the restart protection 
returns the normal program display (V 6 N 63 in this case) "killing" the 
monitor. The Crew again requested V16K68 at 39 m 19 s . This time they exited 
the monitor after about 10 seconds and no alarm was experienced. 

About 2 minutes later at 4l® 31 S P64 (high gate and the start of the 
visibility phase) was entered and nearly one minute later at 42 m 17 s a 1201 
Alarm was experienced with no Crew DSKY activity. 24 sec. later there was 
a 1202 and 16 seconds later another 1202 again without CREW initiated DSKY 
activity. 24 seconds after that, at 43 m 21 s , they were in P 66 and there 
were no more alarms. 

Recapping, in P 63 there were two alarms in each case after 12 seconds 
of a monitor verb. One other use of the monitor for 9 or 10 seconds did 
not induce an alarm. 

P64 was used for 110 seconds. 46 seconds after entry there was a 1201 
followed in 24 seconds by a 1202 and l 6 seconds after that, a final 1202. 
There was no Crew DSKY activity related to these. P 66 was free of alarms. 

DISCUSSION OF CAUSES 


The direct cause of the alarms was an overloading of the IGC's Job 
control routine. However, the programs are designed and tested so that this 
will not occur. Apparently an unaccounted for activity was. going on in the 
computer that it could not handle along with extended use of monitor verbs 
in P 63 and with only basic operation in P64. It has been determined that 
this unaccounted for activity related to the Rendezvous Radar CDU interface. 


the 


In order 
following 


to make clearer how a data interface could affect Job schedulin 
discussion of the organization of the LCC is presented. 
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First, a basic design decision for the machine was to service the i/O 
ultimately thru the central processor (rather than by added hardware 
registers as is done in the AEA or by auxiliary processors). There are 
three I/O classes based on frequency. Low frequency i/O is handled by 
several flip flop banks or "channels”. The In channels are read by 
machine instruction under mailine program control as required to keep 
the program up on the status of the discretes". Similarly, channels of 
flip flops can be set or written by program to provide output signals 
to the S/C and to other systems. 

Medium frequency i/O requiring prompt recognition such as DSKY 
keystrokes is handled by a Priority Program Interrupt system that 
suspends certain (non-interrupt mode) types of coded programs to call 
up specific service routines. 


The effects of the first class of i/O is rather directly apparent in 
the coding and is tested directly in program execution. The effect of the 
second class is deterministic subsequent to its initiation, but its occur- 
rance is random in time and frequency in some cases. 

The* third class covers the high frequency serial data and the broad 
spectrum data that must not suffer losses such as the PIPA's and CDU's. 
These interfaces are serviced by an Involuntary Counter Interrupt system. 
Consider the case of a CDU input. The hardware of the computer recognizes 
each signal under its control. A plus trunnion angle pulse causes the 
Counter Interrupt system to stop the central processor’s sequence generator 
at the end of the next coded instruction and to "snatch" one computer sub- 
instruction tins - memory cycle time, MCT - to bring the contents of a 
specific erasable memory location assigned to the trunnion CDU into the 
adder. The contents are incremented by 1 and returned to E Memory. These 
E Memory locations are unfortunately referred to as counters though only 
schematically equivalent to the usual hardware counter. This activity 
occurs in one MCT, 11.72 micro seconds, and has no immediate outward 
effect on program flow such as a Program Interrupt does. However, the net 
effect of sustaining this interface on the central processor is a real time 
overhead burden. For example a constant 3KC rate of counter interrupts 
would mean a loss of 3of real time available to the CP for other work. 


In their All Digital Simulation testing of programs the MIT/lL directly 
accounts for ohe time loss due to all predictable counter interrupt activity. 
For example, if an angle is to change a certain amount this means there will 
be a corresponding time loss. To provide a pad and to account for unknown 
or undeterminate effects such as vibration effects on the MJ, tests are 
commonly run with an additional real time overhead of about 10 $. This is 
mnemonically referred to by the Simulator as TLOSS. 


The other facet to the situation is that the LGC does not execute in 
specific deterministic- pattern in a way such as the AEA does. Rather it 
includes routines for self scheduling, the EXECUTIVE and the WAITLIST 
routines mentioned at the beginning. These routines handle the scheduling 
of (l) Jobs which have priority numbers and (2) Tasks which are activities 
that must be done at specific times. The result is hopefully a most effi¬ 
cient use of Central Processor time. In the periods of heaviest and most 
complex computer activity - powered descent and ascent - there is an 
intricate interplay of Tasks and Jobs to be controlled by the scheduling 
service routines. The guidance is based on recomputing every two seconds 




navigation data, guidance commands (Throttle and steering), and 
converting the steering from guidance to DAP control outputs. At even 
more frequent'rates data to drive the tape meters (alt. and alt. rate) 
and cross'pointers must be computed. Since the computation work is 
done as Jobs, the arrangement is to have these.Jobs requested of EXECUTIVE 
at specific times from Tasks scheduled and timed by the WAITLIST. The 
time'scheduling is basically "open loop" with respect to whether the Job 
activity scheduled on the previous cycle was in fact completed. It is' 
therefore conceivable that a Job. might not get done (and so be removed 
from the EXECUTIVES^ assignment list) before its scheduling Task came 
up again and asked the EXECUTIVE to schedule it. Multiple entries such 
as this, on their own or in conjunction with some heavy reandom request 
such as a monitor verb, could overload the EXECUTIVE as was experienced 
in this Flight. 

Of course in the above the key question is why couldn T t some Job(s) 
get done in time since they were designed and tested to be able to. There 
are several possibilities: (l) some Jobs might actually take longer than 
planned under some circumstances - certain solutions are obtained by 
iteration, for example. ( 2 ) since the EXECUTIVE puts the Jobs under its 
control on line in order of their priority number, it is possible that 
the relative priority assignments was-not exactly optimum. Some higher 
frequency Job might not have a high enough priority to assure it would 
always be done in its period. ( 3 ) the amount of real time on the Central 
Processor available to mainline program might be significantly less than 
expected. Since these programs have been successfully tested stressed 
by a 10# TLOSS, it seems that the third possibility is most likely although 
the others could have contributed slightly. 

DISCUSSION OF THE RR - CPU - IGC INTERFACE . 

(See Figure 1.") 

It has been determined that the RR-CDU-IGC interface was so configured 
during powered descent that the CDU ! s (shaft and trunnion) were receiving 
inputs (analog) signals that caused them to "slew" in an attempt to digitize 
the inputs. That is, they selected the 6.4 KC pulse train to drive the read 
counter and the IOC. For both channels this means 12,800 counter interrupts 
must be handled by the IGC per second. At about 12 ja. secs each this takes 
about .15 seconds per second or a 15# real time overhead burden on CP time. 

This is above the 10# TLOSS used in verification. P 63 could not handle 
this in the presence of a monitor verb and P64 was marginal at this level 

(15 i ) ■ 

Figure 1 roughly schematizes the situation. When the RR panel switch 
is in LGC the RR resolvers receive their 800 cps reference from the Primary 
System. In SLEW or AUTO, however, they receive this reference from the ATCA. 
This voltage is frequency controlled by the Primary System through its control 
of the PCMTEA, but it is not phase controlled nor is it of. the same magnitude 
wave form. These features of the resolver input to the CDU A/D converter 
section when not in IGC caused the CDU to "SLEW" (digitally) . Note that neither 
RR ON/OFF or mode controls affect the CDU-LC-C A 9 interface. Also the RR 
breakers do not control the reference voltage connection from the ATCA to the 
resolvers. Data shows the RR was not in IGC during this period and also that 
the RR CDU Fail Discrete (CH 3 OBO 7 ) was present. This discrete is set by a 
number of problems one of which is an excessive error condition. 


The CDU’s also contain 
capability of the two RR CL 
pointers when the MODE SEL 


digital to analog conversion 
U's is used to permit the IGC 
switch is in IONS (CK 3 .OBO 6 ). 


capability and this 
to drive the cross 
This is commonly 
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referred to as the Display Inertial Data Mode. If the RR is in IGC but 
not locked on, the output of the D to A converter goes to the radar so 
it would be possible to try to designate the antenna with cross pointer 
inertial velocity data (undesireable). When in SLEW or AUTO this "false” 
designate possibility does not exist. For this reason the RR was in the 
AUTO mode for IM-5. 

FCI LAB TESTING 

The FCI laboratory does not have an RR antenna with the resolvers 
or substitude servos with resolver;*-. It does have the hardware CDU's, 
which are a part of the CDU assembly along with the inertial channels. 

The FMES (Environment) computers t.nd interface equipment supply angle 
information at the IGC pulse (AOf interface, substituting for the CDU's. 

This data is normally processed : ^T4;he Involuntary Counter Interrupt 
control. In order to simulate Y/v- actual condition that occurred in descent^ 
one of the following changes c-V^he made: (l) Make an analog circuit to 
input the A/D end of the CDU 1 s with a signal of like characteristics as 
developed by the RR resolvers vib'-h the ATCA supplied reference. ( 2 ) Put 
6.4 KC on the present interfaces. In order to check out changes in the 
Flight Program for Apollo 12, LUMINARY IB, the first arrangement will be 
required. 

LUMINARY IB, which will be tested in the FCI lab shortly, contains two 
changes pertinent to the subject at hand. One, covered by PCR 8l4, provides 
for a modified V57 which incorporates a display of N68, thereby doing away 
with any need for a monitor verb. MIT/lL estimated in the PCR a % computer 
time saving. The second was a change resulting from Apollo 11, PCR 848, which 
provides for issuing RR CDU ZERO'S while the RR is not in IGC. This.CDU mode 
should have the effect of preventing any digitizing of an input to the CDU. 

In order to properly test this arrangement the CDU-IGC interface should be 
in, indicating we need an arrangement inputing the analog end of the CDU T s. 
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Note that regarding LR data Ch33 indicates LR ALT & VEL Data Good at 
37 m 49 s both dropout at 44 m 9 s back at 44 m 19 s ; both out at 44 m 57 s and 
back at 45 m 01 s and both out at 45 m 39 s * There are many time gaps in 
these bi levels. 
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FIG'1. Rough Schematic of RR-CDU-IGC Interface. 
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